Technical Tip: How to configure FortiManager as local FortiGuard Distribution Server For FortiSandbox

[yashwani]

Description	This article describes how to configure FortiManager to act as a FortiGuard Distribution Server for FortiSandbox. This is useful in air-gapped or controlled environments where FortiSandbox cannot reach FortiGuard services directly over the internet. FortiManager will act as a local relay to provide updates such as antivirus, IPS, and FortiSandbox packages.
Scope	FortiManager v7.4 or later, FortiSandbox v4.4 or later. Options are available under lower versions as well, but might be at different GUI options.
Solution	Prerequisites: FortiManager must have internet access to retrieve FortiGuard updates. FortiSandbox must be able to reach FortiManager over the network. Ensure both FortiManager and FortiSandbox are licensed and registered with Fortinet. DNS must be resolvable or use a static IP-based override. Configuration on FortiManager: Under FortiGuard -> Settings, enable Communication with FortiGuard Server, enable Antivirus and IPS Service, select the version of FortiSandbox or the Firmware versions series for which FortiSandbox should get the updates from FortiManager.  Under System Settings -> Network, edit the network Interface, enable Web Service and FortiManager Fabric under Administrative access, enable FortiGate Updates & Web Filtering under service access, and select 'OK'. Configuration on FortiSandbox: Go to System Settings  -> FortiGuard.  FortiGuard Server Settings.  Specify the FortiManager IP address under Use Override FDN Server to download module updates Use the override server (FortiManager IP address) for FortiWeb Web filter settings, select Connect FDN Now, and Apply.  On FortiSandbox, FortiManager can be used for FortiGuard server and web filtering updates only. FortiManager cannot be used for FortiSandbox WindowsCloudVM Settings and FortiSandbox Real-time Zero-Day Anti-Phishing Service Settings.